IoT Penetration Testing CPENT Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   You are testing a smart door lock that is controlled by a mobile app via BLE. The app also has a cloud backend for remote access. You have discovered that the BLE pairing process uses a static PIN that is printed on the device. An attacker with physical access to the device can read the PIN and pair with the lock. What is the MOST effective mitigation to recommend?

   • AImplement a pairing method that uses a dynamic PIN displayed on the device's screen or generated by the app, and require user confirmation.
   • BUse a longer static PIN, such as 8 digits, to make brute-force attacks harder.
   • CUse a fixed encryption key for all BLE communication to prevent eavesdropping.
   • DDisable BLE pairing entirely and require the user to use the cloud backend for all operations.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   You are testing a smart lighting system that uses Zigbee for device-to-device communication and a Zigbee coordinator that connects to the internet via a hub. You want to test for unauthorized control of the lights. Which of the following is the MOST effective testing approach?

   • AReplay captured Zigbee commands from the coordinator to the lights.
   • BPerform a brute-force attack on the Zigbee coordinator's web interface.
   • CUse a Zigbee sniffer to capture network traffic and attempt to join the Zigbee network by sniffing the network key during a legitimate device join.
   • DUse a BLE sniffer to capture traffic between the lights and the hub.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During a firmware analysis of an IP camera, a tester extracts the root filesystem and finds a script that connects to a remote server using hardcoded credentials. The tester wants to determine if these credentials are also used elsewhere in the device. Which step should the tester take next?

   • AImmediately attempt to log in to the remote server with the credentials
   • BDisassemble the kernel to find the credentials
   • CFlash the firmware back to the device to see if the credentials work
   • DSearch the entire filesystem for the same username or password strings
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which vulnerability is commonly tested in the cloud web interface of an IoT system?

   • AUART debug access
   • BInsecure direct object references (IDOR)
   • CRF signal jamming
   • DBuffer overflow in the device firmware
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which hardware interface is commonly used for debugging and provides a serial console to the device?

   • AUSB
   • BI2C
   • CSPI
   • DUART
   Reveal Solution Discussion Select an answer first